Accelerate Observability of the Database Foundations Underpinning.pdf

Accelerate Observability of the Database Foundations Underpinning

1. Forward-
looking
statements
This presentation may contain forward-looking statements that are subject to the safe harbors created under the Securities Act of 1933, as
amended, and the Securities Exchange Act of 1934, as amended. All statements other than statements of historical facts are statements
that could be deemed forward-looking statements. These statements are based on current expectations, estimates, forecasts, and
projections about the industries in which we operate and the beliefs and assumptions of our management based on the information
currently available to us. Words such as “expects,” “anticipates,” “targets,” “goals,” “projects,” “intends,” “plans,” “believes,” “momentum,”
“seeks,” “estimates,” “continues,” “endeavors,” “strives,” “may,” variations of such words, and similar expressions are intended to identify
such forward-looking statements. In addition, any statements that refer to (1) our goals, commitments, and programs; (2) our business
plans, initiatives, and objectives; and (3) our assumptions and expectations, including our expectations regarding our financial
performance, products, technology, strategy, customers, markets, acquisitions and investments are forward-looking statements. These
forward-looking statements are not guarantees of future performance and involve significant risks, uncertainties and other factors that
may cause our actual results, performance or achievements to be materially different from results, performance or achievements
expressed or implied by the forward-looking statements contained in this presentation. Readers are cautioned that these forward-looking
statements are only predictions and are subject to risks, uncertainties, and assumptions that are difficult to predict, including those
identified in the “Risk Factors” section of Cisco’s most recent report on Form 10-Q filed on May 21, 2024 and its most recent report on Form
10-K filed on September 7, 2023. The forward-looking statements made in this presentation are made as of the time and date of this
presentation. If reviewed after the initial presentation, even if made available by Cisco or Splunk, on Cisco or Splunk’s website or otherwise,
it may not contain current or accurate information. Cisco and Splunk undertake no obligation to revise or update any forward-looking
statements for any reason, except as required by law.
In addition, any information about new products, features, functionality or our roadmap outlines our general product direction and is
subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other
commitment or be relied upon in making a purchasing decision. We undertake no commitment, promise or obligation either to develop the
features or functionalities described, in beta or in preview (used interchangeably), or to include any such feature or functionality in a future
release. The development, release, and timing of any features or functionality described for our products remains at our sole discretion.

Splunk and Splunk> are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand
names, product names, or trademarks belong to their respective owners. © 2024 Splunk Inc. All rights reserved.
© 2024 SPLUNK INC.

2. © 2024 SPLUNK INC.
Accelerate
Observability of
the Database
Foundations
Underpinning
Your Application
Architectures
OBS1801B

3. © 2024 SPLUNK INC.
Principal Product Manager
Splunk
Joe deBlaquiere

4. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
Evolving Patterns of Database Systems
Database usage patterns drive patterns for observability
●Customers maintaining breadth
of deployment patterns
‒Self-managed
‒Cloud-managed (e.g.
Microsoft® Azure SQL,
Amazon RDS®)
‒Cloud-abstract (e.g. Amazon
DynamoDB®, Big Query™)
‒PaaS (Snowflake®,
MonogoDB® Atlas)
●“E) All of the above”
●Developers increasingly choose
more specialized platforms
‒Relational (SQL, still the
king)
‒Time-series
‒NoSQL
‒(Many more)
●“E) All of the above”
●Diversity of scales
‒Instance
‒Cluster
‒Data warehouse
●Proliferation of Microservices =
distributed db clients
●Polyglot in language, diverse in
database technologies
●“E) All of the above”
Cloud / Hybrid Specialized Technologies Usage Patterns

5. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
Observability,
for Databases.

●Observability is application
centered; apps depend on DBs
●Many sources of telemetry, Many
types of telemetry: Metrics,
Events, Logs and Traces (MELT)
●Correlation is key (or key-value in
metadata)
●Observability is a team sport;
variety of skills / familiarity with
databases
●Monitoring + Troubleshooting =
Mean time to clue

6. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
It’s the
Application.

●Transaction tracing in Splunk
APM directly measures
experience; expressed by RED
metrics
‒Rate
‒Errors
‒Duration
●Correlation of telemetry drives
pivot experience
‒Client-instance correlation
ties App to DB metrics
‒Correlated logs, events
The “goal” is to ensure
applications deliver
optimal user experience.

7. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
It’s (still) the
Application.

●Identify Problems
‒Built-in detector alerts and
Troubleshooting views support
health/availability monitoring
‒Infrastructure pivot
correlation to host/VM metrics
●Determine Impact
‒Instances correlated to clients
and queries

The "goal" of monitoring
DB infrastructure is finding
problems before they
impact Apps.

8. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
DB Telemetry Sources, Types.
Telemetry comes from many places in many formats.
●APM tracing measures query RED metrics,
correlated to transaction

9. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
DB Telemetry Sources, Types.
Telemetry comes from many places in many formats.
●APM tracing measures query RED metrics,
correlated to transaction
●Cloud platform metrics track basic performance,
resource utilization

10. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
DB Telemetry Sources, Types.
Telemetry comes from many places in many formats.
●APM tracing measures query RED metrics,
correlated to transaction
●Cloud platform metrics track basic performance,
resource utilization
●OpenTelemetry™ host metrics monitor host/VM

11. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
DB Telemetry Sources, Types.
Telemetry comes from many places in many formats.
●APM tracing measures query RED metrics,
correlated to transaction
●Cloud platform metrics track basic performance,
resource utilization
●OpenTelemetry host metrics monitor host/VM
●OpenTelemetry infrastructure service metrics
‒monitor service usage, resource utilization
‒identify contention between sessions (e.g. locks)

12. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
DB Telemetry Sources, Types.
Telemetry comes from many places in many formats.
●APM tracing measures query RED metrics,
correlated to transaction
●Cloud Platform metrics track basic performance,
resource utilization
●OpenTelemetry host metrics monitor host/VM
●OpenTelemetry infrastructure service metrics
‒monitor service usage, resource utilization
‒identify contention between sessions (e.g. locks)
‒per-instance metrics

13. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
DB Telemetry Sources, Types.
Telemetry comes from many places in many formats.
●APM tracing measures query RED metrics,
correlated to transaction
●Cloud platform metrics track basic performance,
resource utilization
●OpenTelemetry host metrics monitor host/VM
●OpenTelemetry infrastructure service metrics
‒monitor service usage, resource utilization
‒identify contention between sessions (e.g. locks)
‒per-instance metrics
●DB platform logs identify (mostly fatal) error
conditions, slow queries

14. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
DB Telemetry Sources, Types.
Telemetry comes from many places in many formats.
●APM tracing measures query RED metrics,
correlated to transaction
●Cloud platform metrics track basic performance,
resource utilization
●OpenTelemetry host metrics monitor host/VM
●OpenTelemetry infrastructure service metrics
‒monitor service usage, resource utilization
‒identify contention between sessions (e.g. locks)
‒per-instance metrics
●DB platform logs identify (mostly fatal) error
conditions, slow queries
●(and metadata helps stitch it all together)

15. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
Database Observability Team*
Breadth of skills, knowledge and responsibilities
●Responsible for application
experience
●Generalist, system-wide view
●Alert responder: APM
●Escalation point for DB issues
●Technology Specialist
●Responsible for DB services,
lifecycle
●Generalist, component view
●Alert responder: IM
App SRE DB Developer Infra SRE
* example roles, depends on level of specialization, team size

16. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
So how’s this all work?

17. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
I got an
alert!

●Service map helps to isolate
problems
●Where, not why
Application SRE as
responder

18. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
It’s the DB,
surprise!

●Infra metrics help triage
‒noisy neighbor?
‒resource limited?
●Where to look next
Application SRE as
responder

19. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
Infra
problem?

●Limiting resources?
‒I/O
‒CPU
‒Memory
●Lock contention?
●…
Infra SRE as escalation
point

20. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
Infra good,
try query?

●Localize to specific query…
●Consistent or intermittent?
Find exemplars
●… DB query stats (query
resources)
●… DB explain plan (query
structure)
●…
Escalation to DB Developer

21. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
What was our
goal?

●Observability is application centered;
apps depend on DBs
●Many sources of telemetry, Many types of
telemetry: Metrics, Events, Logs and
Traces (MELT)
●Correlation is key (or key-value in
metadata)
●Observability is a team sport; variety of
skills / familiarity with databases

●Monitoring +
Troubleshooting = Mean
time to clue

22. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.
Where to
start?

●Cloud services - quick win
●APM - key applications
●IM - key technologies

(and keep building depth)
Many sources = many
options

23. Splunk .conf24 Template | TMPLT-FY25-101
© 2024 SPLUNK INC.© 2024 SPLUNK INC.
Splunk
Community
Office Hours
Where technical Splunk
experts answer your questions
and provide live, how-to
guidance on various topics.

Check out upcoming
Observability Office Hour
sessions and register today!

bit.ly/splunk-office-hours
Join us on Slack #office_hours

24. © 2024 SPLUNK INC.
Thank you